Migrate Secret Scanning failing to reconcile alerts
- Dominant language
- C#
- Stars
- 478
- Forks
- 146
- Avg merge
- 7d 21h
- Merged PRs (30d)
- 2
Description
## Description
I have a customer who is seeing failed secret scanning alerts when migrating from GHES to GHEC-US. The secret scanning alerts have been resolved and closed in source repositories but are not closed post-migration in the destination. This is post-GEI migration. The alert number differs in the source, where secret 1 in the destination is secret 2 in the source. The destination org has a global policy to enable advanced security features.
```
2026-07-09 16:05:05] [INFO] Migrating Secret Scanning Alerts...
[2026-07-09 16:05:05] [INFO] Migrating Secret Scanning Alerts from 'srcOrg/myRepo' to 'destOrg/myRepo'
[2026-07-09 16:05:06] [INFO] Source srcOrg/myRepo secret alerts found: 2
[2026-07-09 16:05:06] [INFO] Target destOrg/myRepo secret alerts found: 1
[2026-07-09 16:05:06] [INFO] Matching secret resolutions from source to target repository
[2026-07-09 16:05:06] [INFO] Processing source secret 2
[2026-07-09 16:05:06] [INFO] secret is resolved, looking for matching secret in target...
[2026-07-09 16:05:06] [WARNING] failed to locate a matching secret to source secret 2 in destOrg/myRepo
[2026-07-09 16:05:06] [INFO] Processing source secret 1
[2026-07-09 16:05:06] [INFO] secret is resolved, looking for matching secret in target...
[2026-07-09 16:05:06] [WARNING] Failed to locate a matching secret to source secret 1 in destOrg/myRepo
[2026-07-09 16:05:06] [INFO] Secret scanning alerts successfully migrated.
```
## Reproduction Steps
We have had this process work for other repositories with the same process:
1. Run GEI repository migration
1. Run GEI secrets migration
Contributor guide
Research direction
Start by reproducing the issue with a GEI repository migration followed by a GEI secrets migration, using the logged source and destination alert counts as a reference. Inspect the secret scanning alert migration and resolution-matching path; done means resolved source alerts are matched and closed in the destination even when alert numbers differ, with logs confirming successful migration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100